🤚 The Open-Palm Raid Report
Dutch financial crime investigators — the FIOD — have seized 800 servers and arrested two men in a sweeping operation targeting a bulletproof hosting operation that was quietly powering cyberattacks, disinformation campaigns, and interference operations across Europe. Raids were conducted simultaneously in Dronten, Schiphol-Rijk, Enschede, and Almere, with authorities confiscating laptops, phones, and administrative records alongside the server hardware.
The arrested individuals include a 57-year-old company director and a 39-year-old who ran a separate firm providing internet connectivity. The infrastructure supported attacks attributed to NoName057(16), the pro-Russian hacktivist group best known for DDoS attacks against Western targets. Danish authorities had previously linked the same infrastructure to attacks in their country.
But here’s where the corporate genealogy gets delicious.
👐 The Two-Handed Shell Game
The hosting firm at the center of this operation was originally called Stark Industries — yes, like the Marvel character, because apparently even cybercriminals want aspirational branding. It was founded on February 10, 2022, which the historically literate will note was two weeks before Russia’s invasion of Ukraine. Subtle.
When the EU imposed sanctions in May 2025, the operation did what every sanctioned entity does: it put on a fake mustache. The infrastructure was transferred to a freshly minted Dutch front company called WorkTitans B.V., operating under the consumer-facing brand THE.Hosting. Because nothing says “we are definitely not the same sanctioned Russian hosting company” like reincorporating in the Netherlands with a LinkedIn-friendly name and a logo that probably uses Montserrat Bold.
Physical connectivity was provided by Mirhosting, an Almere-based outfit that supplied servers, colocation services, and high-capacity links through major internet exchanges in Amsterdam and Frankfurt. In other words, the backbone of European internet infrastructure was cheerfully routing traffic for a sanctioned operation that had merely changed its business cards.
🌿 The Gentle Awakening
There is something philosophically magnificent about a company called “Stark Industries” getting taken down by law enforcement. In the Marvel universe, Stark Industries pivots from weapons manufacturing to heroic technology. In the real world, Stark Industries pivots from “hosting cyberattacks for pro-Russian hacktivists” to “hosting cyberattacks for pro-Russian hacktivists but from a Dutch address.”
The rebranding to “WorkTitans” is the part that truly deserves a chef’s kiss. The name suggests a workforce productivity platform, possibly one that integrates with Slack and has a freemium tier. Instead, it was a vehicle for routing DDoS traffic, disinformation campaigns, and what the Dutch authorities euphemistically call “interference operations disrupting public and economic systems.” One imagines the WorkTitans B.V. website featured stock photos of diverse professionals shaking hands over a conference table, while the actual product was a rack of servers enabling state-sponsored chaos.
👑 The Gold-Leaf Geopolitical Reckoning
This takedown illustrates a persistent and deeply annoying pattern in cybersecurity enforcement. Sanctioned entities don’t disappear — they rebrand. Shell companies are the VPNs of corporate malfeasance. You can seize 800 servers in four Dutch cities, arrest the principals, confiscate their phones, and feel very good about the press conference, but the playbook itself is open-source: register a new company, lease new servers, route through a different exchange, repeat.
The NoName057(16) connection adds geopolitical weight. This group has been one of the most prolific pro-Russian hacktivist operations since 2022, targeting government websites, banks, and critical infrastructure across NATO countries with DDoS attacks that are less sophisticated than they are persistent. Taking out their hosting infrastructure is meaningful but unlikely to be permanent — these groups treat server seizures the way most companies treat quarterly reorganizations: inconvenient but ultimately cosmetic.
Still, 800 servers is 800 servers. The FIOD has disrupted a significant node in the pro-Russian cyber-operations ecosystem, and the arrests signal that European law enforcement is increasingly willing to follow the corporate shell game to its logical conclusion. Whether that conclusion involves another front company registered in a different EU member state by next quarter remains, as they say, an exercise left to the reader.
“They named it Stark Industries, rebranded it WorkTitans, and hosted it in the Netherlands. The only thing missing was a Glassdoor profile with five-star reviews from ‘Anonymous Hacktivist.'” — The Slap of Wisdom International Desk, currently verifying that our own hosting provider was not, in fact, a sanctioned front company this entire time